1de65191e8e910f1c5039ad14366588e21fbb2bc
[abartlet/samba.git/.git] / source4 / dsdb / tests / python / ldap_schema.py
1 #!/usr/bin/env python
2 # -*- coding: utf-8 -*-
3 # This is a port of the original in testprogs/ejs/ldap.js
4
5 # Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2008-2011
6 #
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
11 #
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 # GNU General Public License for more details.
16 #
17 # You should have received a copy of the GNU General Public License
18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
19
20
21
22 import optparse
23 import sys
24 import time
25 import random
26 import os
27
28 sys.path.insert(0, "bin/python")
29 import samba
30 from samba.tests.subunitrun import TestProgram, SubunitOptions
31
32 import samba.getopt as options
33
34 from samba.auth import system_session
35 from ldb import SCOPE_ONELEVEL, SCOPE_BASE, LdbError
36 from ldb import ERR_NO_SUCH_OBJECT
37 from ldb import ERR_UNWILLING_TO_PERFORM
38 from ldb import ERR_CONSTRAINT_VIOLATION
39 from ldb import Message, MessageElement, Dn
40 from ldb import FLAG_MOD_REPLACE
41 from samba.samdb import SamDB
42 from samba.dsdb import DS_DOMAIN_FUNCTION_2003
43 from samba.tests import delete_force
44
45 parser = optparse.OptionParser("ldap_schema.py [options] <host>")
46 sambaopts = options.SambaOptions(parser)
47 parser.add_option_group(sambaopts)
48 parser.add_option_group(options.VersionOptions(parser))
49 # use command line creds if available
50 credopts = options.CredentialsOptions(parser)
51 parser.add_option_group(credopts)
52 subunitopts = SubunitOptions(parser)
53 parser.add_option_group(subunitopts)
54 opts, args = parser.parse_args()
55
56 if len(args) < 1:
57     parser.print_usage()
58     sys.exit(1)
59
60 host = args[0]
61
62 lp = sambaopts.get_loadparm()
63 creds = credopts.get_credentials(lp)
64
65
66 class SchemaTests(samba.tests.TestCase):
67
68     def setUp(self):
69         super(SchemaTests, self).setUp()
70         self.ldb = SamDB(host, credentials=creds,
71             session_info=system_session(lp), lp=lp, options=ldb_options)
72         self.base_dn = self.ldb.domain_dn()
73         self.schema_dn = self.ldb.get_schema_basedn().get_linearized()
74
75     def test_generated_schema(self):
76         """Testing we can read the generated schema via LDAP"""
77         res = self.ldb.search("cn=aggregate,"+self.schema_dn, scope=SCOPE_BASE,
78                 attrs=["objectClasses", "attributeTypes", "dITContentRules"])
79         self.assertEquals(len(res), 1)
80         self.assertTrue("dITContentRules" in res[0])
81         self.assertTrue("objectClasses" in res[0])
82         self.assertTrue("attributeTypes" in res[0])
83
84     def test_generated_schema_is_operational(self):
85         """Testing we don't get the generated schema via LDAP by default"""
86         # Must keep the "*" form
87         res = self.ldb.search("cn=aggregate,"+self.schema_dn, scope=SCOPE_BASE,
88                               attrs=["*"])
89         self.assertEquals(len(res), 1)
90         self.assertFalse("dITContentRules" in res[0])
91         self.assertFalse("objectClasses" in res[0])
92         self.assertFalse("attributeTypes" in res[0])
93
94     def test_schemaUpdateNow(self):
95         """Testing schemaUpdateNow"""
96         attr_name = "test-Attr" + time.strftime("%s", time.gmtime())
97         attr_ldap_display_name = attr_name.replace("-", "")
98
99         ldif = """
100 dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
101 objectClass: top
102 objectClass: attributeSchema
103 adminDescription: """ + attr_name + """
104 adminDisplayName: """ + attr_name + """
105 cn: """ + attr_name + """
106 attributeId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9940
107 attributeSyntax: 2.5.5.12
108 omSyntax: 64
109 instanceType: 4
110 isSingleValued: TRUE
111 systemOnly: FALSE
112 """
113         self.ldb.add_ldif(ldif)
114         # We must do a schemaUpdateNow otherwise it's not 100% sure that the schema
115         # will contain the new attribute
116         ldif = """
117 dn:
118 changetype: modify
119 add: schemaUpdateNow
120 schemaUpdateNow: 1
121 """
122         self.ldb.modify_ldif(ldif)
123
124         # Search for created attribute
125         res = []
126         res = self.ldb.search("cn=%s,%s" % (attr_name, self.schema_dn), scope=SCOPE_BASE,
127                               attrs=["lDAPDisplayName","schemaIDGUID"])
128         self.assertEquals(len(res), 1)
129         self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_display_name)
130         self.assertTrue("schemaIDGUID" in res[0])
131
132         class_name = "test-Class" + time.strftime("%s", time.gmtime())
133         class_ldap_display_name = class_name.replace("-", "")
134
135         # First try to create a class with a wrong "defaultObjectCategory"
136         ldif = """
137 dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
138 objectClass: top
139 objectClass: classSchema
140 defaultObjectCategory: CN=_
141 adminDescription: """ + class_name + """
142 adminDisplayName: """ + class_name + """
143 cn: """ + class_name + """
144 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
145 instanceType: 4
146 objectClassCategory: 1
147 subClassOf: organizationalPerson
148 systemFlags: 16
149 rDNAttID: cn
150 systemMustContain: cn
151 systemMustContain: """ + attr_ldap_display_name + """
152 systemOnly: FALSE
153 """
154         try:
155                  self.ldb.add_ldif(ldif)
156                  self.fail()
157         except LdbError, (num, _):
158                  self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
159
160         ldif = """
161 dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
162 objectClass: top
163 objectClass: classSchema
164 adminDescription: """ + class_name + """
165 adminDisplayName: """ + class_name + """
166 cn: """ + class_name + """
167 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
168 instanceType: 4
169 objectClassCategory: 1
170 subClassOf: organizationalPerson
171 systemFlags: 16
172 rDNAttID: cn
173 systemMustContain: cn
174 systemMustContain: """ + attr_ldap_display_name + """
175 systemOnly: FALSE
176 """
177         self.ldb.add_ldif(ldif)
178
179         # Search for created objectclass
180         res = []
181         res = self.ldb.search("cn=%s,%s" % (class_name, self.schema_dn), scope=SCOPE_BASE,
182                               attrs=["lDAPDisplayName", "defaultObjectCategory", "schemaIDGUID", "distinguishedName"])
183         self.assertEquals(len(res), 1)
184         self.assertEquals(res[0]["lDAPDisplayName"][0], class_ldap_display_name)
185         self.assertEquals(res[0]["defaultObjectCategory"][0], res[0]["distinguishedName"][0])
186         self.assertTrue("schemaIDGUID" in res[0])
187
188         ldif = """
189 dn:
190 changetype: modify
191 add: schemaUpdateNow
192 schemaUpdateNow: 1
193 """
194         self.ldb.modify_ldif(ldif)
195
196         object_name = "obj" + time.strftime("%s", time.gmtime())
197
198         ldif = """
199 dn: CN=%s,CN=Users,%s"""% (object_name, self.base_dn) + """
200 objectClass: organizationalPerson
201 objectClass: person
202 objectClass: """ + class_ldap_display_name + """
203 objectClass: top
204 cn: """ + object_name + """
205 instanceType: 4
206 objectCategory: CN=%s,%s"""% (class_name, self.schema_dn) + """
207 distinguishedName: CN=%s,CN=Users,%s"""% (object_name, self.base_dn) + """
208 name: """ + object_name + """
209 """ + attr_ldap_display_name + """: test
210 """
211         self.ldb.add_ldif(ldif)
212
213         # Search for created object
214         res = []
215         res = self.ldb.search("cn=%s,cn=Users,%s" % (object_name, self.base_dn), scope=SCOPE_BASE, attrs=["dn"])
216         self.assertEquals(len(res), 1)
217         # Delete the object
218         delete_force(self.ldb, "cn=%s,cn=Users,%s" % (object_name, self.base_dn))
219
220     def test_subClassOf(self):
221         """ Testing usage of custom child schamaClass
222         """
223
224         class_name = "my-Class" + time.strftime("%s", time.gmtime())
225         class_ldap_display_name = class_name.replace("-", "")
226
227         ldif = """
228 dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
229 objectClass: top
230 objectClass: classSchema
231 adminDescription: """ + class_name + """
232 adminDisplayName: """ + class_name + """
233 cn: """ + class_name + """
234 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
235 instanceType: 4
236 objectClassCategory: 1
237 subClassOf: organizationalUnit
238 systemFlags: 16
239 systemOnly: FALSE
240 """
241         self.ldb.add_ldif(ldif)
242
243         # Search for created objectclass
244         res = []
245         res = self.ldb.search("cn=%s,%s" % (class_name, self.schema_dn), scope=SCOPE_BASE,
246                               attrs=["lDAPDisplayName", "defaultObjectCategory",
247                                      "schemaIDGUID", "distinguishedName"])
248         self.assertEquals(len(res), 1)
249         self.assertEquals(res[0]["lDAPDisplayName"][0], class_ldap_display_name)
250         self.assertEquals(res[0]["defaultObjectCategory"][0], res[0]["distinguishedName"][0])
251         self.assertTrue("schemaIDGUID" in res[0])
252
253         ldif = """
254 dn:
255 changetype: modify
256 add: schemaUpdateNow
257 schemaUpdateNow: 1
258 """
259         self.ldb.modify_ldif(ldif)
260
261         object_name = "org" + time.strftime("%s", time.gmtime())
262
263         ldif = """
264 dn: OU=%s,%s""" % (object_name, self.base_dn) + """
265 objectClass: """ + class_ldap_display_name + """
266 ou: """ + object_name + """
267 instanceType: 4
268 """
269         self.ldb.add_ldif(ldif)
270
271         # Search for created object
272         res = []
273         res = self.ldb.search("ou=%s,%s" % (object_name, self.base_dn), scope=SCOPE_BASE, attrs=["dn"])
274         self.assertEquals(len(res), 1)
275         # Delete the object
276         delete_force(self.ldb, "ou=%s,%s" % (object_name, self.base_dn))
277
278
279 class SchemaTests_msDS_IntId(samba.tests.TestCase):
280
281     def setUp(self):
282         super(SchemaTests_msDS_IntId, self).setUp()
283         self.ldb = SamDB(host, credentials=creds,
284             session_info=system_session(lp), lp=lp, options=ldb_options)
285         res = self.ldb.search(base="", expression="", scope=SCOPE_BASE,
286                          attrs=["schemaNamingContext", "defaultNamingContext",
287                                 "forestFunctionality"])
288         self.assertEquals(len(res), 1)
289         self.schema_dn = res[0]["schemaNamingContext"][0]
290         self.base_dn = res[0]["defaultNamingContext"][0]
291         self.forest_level = int(res[0]["forestFunctionality"][0])
292
293     def _ldap_schemaUpdateNow(self):
294         ldif = """
295 dn:
296 changetype: modify
297 add: schemaUpdateNow
298 schemaUpdateNow: 1
299 """
300         self.ldb.modify_ldif(ldif)
301
302     def _make_obj_names(self, prefix):
303         class_name = prefix + time.strftime("%s", time.gmtime())
304         class_ldap_name = class_name.replace("-", "")
305         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
306         return (class_name, class_ldap_name, class_dn)
307
308     def _is_schema_base_object(self, ldb_msg):
309         """Test systemFlags for SYSTEM_FLAG_SCHEMA_BASE_OBJECT (16)"""
310         systemFlags = 0
311         if "systemFlags" in ldb_msg:
312             systemFlags = int(ldb_msg["systemFlags"][0])
313         return (systemFlags & 16) != 0
314
315     def _make_attr_ldif(self, attr_name, attr_dn):
316         ldif = """
317 dn: """ + attr_dn + """
318 objectClass: top
319 objectClass: attributeSchema
320 adminDescription: """ + attr_name + """
321 adminDisplayName: """ + attr_name + """
322 cn: """ + attr_name + """
323 attributeId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9940
324 attributeSyntax: 2.5.5.12
325 omSyntax: 64
326 instanceType: 4
327 isSingleValued: TRUE
328 systemOnly: FALSE
329 """
330         return ldif
331
332     def test_msDS_IntId_on_attr(self):
333         """Testing msDs-IntId creation for Attributes.
334         See MS-ADTS - 3.1.1.Attributes
335
336         This test should verify that:
337         - Creating attribute with 'msDS-IntId' fails with ERR_UNWILLING_TO_PERFORM
338         - Adding 'msDS-IntId' on existing attribute fails with ERR_CONSTRAINT_VIOLATION
339         - Creating attribute with 'msDS-IntId' set and FLAG_SCHEMA_BASE_OBJECT flag
340           set fails with ERR_UNWILLING_TO_PERFORM
341         - Attributes created with FLAG_SCHEMA_BASE_OBJECT not set have
342           'msDS-IntId' attribute added internally
343         """
344
345         # 1. Create attribute without systemFlags
346         # msDS-IntId should be created if forest functional
347         # level is >= DS_DOMAIN_FUNCTION_2003
348         # and missing otherwise
349         (attr_name, attr_ldap_name, attr_dn) = self._make_obj_names("msDS-IntId-Attr-1-")
350         ldif = self._make_attr_ldif(attr_name, attr_dn)
351
352         # try to add msDS-IntId during Attribute creation
353         ldif_fail = ldif + "msDS-IntId: -1993108831\n"
354         try:
355             self.ldb.add_ldif(ldif_fail)
356             self.fail("Adding attribute with preset msDS-IntId should fail")
357         except LdbError, (num, _):
358             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
359
360         # add the new attribute and update schema
361         self.ldb.add_ldif(ldif)
362         self._ldap_schemaUpdateNow()
363
364         # Search for created attribute
365         res = []
366         res = self.ldb.search(attr_dn, scope=SCOPE_BASE,
367                               attrs=["lDAPDisplayName", "msDS-IntId", "systemFlags"])
368         self.assertEquals(len(res), 1)
369         self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_name)
370         if self.forest_level >= DS_DOMAIN_FUNCTION_2003:
371             if self._is_schema_base_object(res[0]):
372                 self.assertTrue("msDS-IntId" not in res[0])
373             else:
374                 self.assertTrue("msDS-IntId" in res[0])
375         else:
376             self.assertTrue("msDS-IntId" not in res[0])
377
378         msg = Message()
379         msg.dn = Dn(self.ldb, attr_dn)
380         msg["msDS-IntId"] = MessageElement("-1993108831", FLAG_MOD_REPLACE, "msDS-IntId")
381         try:
382             self.ldb.modify(msg)
383             self.fail("Modifying msDS-IntId should return error")
384         except LdbError, (num, _):
385             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
386
387         # 2. Create attribute with systemFlags = FLAG_SCHEMA_BASE_OBJECT
388         # msDS-IntId should be created if forest functional
389         # level is >= DS_DOMAIN_FUNCTION_2003
390         # and missing otherwise
391         (attr_name, attr_ldap_name, attr_dn) = self._make_obj_names("msDS-IntId-Attr-2-")
392         ldif = self._make_attr_ldif(attr_name, attr_dn)
393         ldif += "systemFlags: 16\n"
394
395         # try to add msDS-IntId during Attribute creation
396         ldif_fail = ldif + "msDS-IntId: -1993108831\n"
397         try:
398             self.ldb.add_ldif(ldif_fail)
399             self.fail("Adding attribute with preset msDS-IntId should fail")
400         except LdbError, (num, _):
401             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
402
403         # add the new attribute and update schema
404         self.ldb.add_ldif(ldif)
405         self._ldap_schemaUpdateNow()
406
407         # Search for created attribute
408         res = []
409         res = self.ldb.search(attr_dn, scope=SCOPE_BASE,
410                               attrs=["lDAPDisplayName", "msDS-IntId"])
411         self.assertEquals(len(res), 1)
412         self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_name)
413         if self.forest_level >= DS_DOMAIN_FUNCTION_2003:
414             if self._is_schema_base_object(res[0]):
415                 self.assertTrue("msDS-IntId" not in res[0])
416             else:
417                 self.assertTrue("msDS-IntId" in res[0])
418         else:
419             self.assertTrue("msDS-IntId" not in res[0])
420
421         msg = Message()
422         msg.dn = Dn(self.ldb, attr_dn)
423         msg["msDS-IntId"] = MessageElement("-1993108831", FLAG_MOD_REPLACE, "msDS-IntId")
424         try:
425             self.ldb.modify(msg)
426             self.fail("Modifying msDS-IntId should return error")
427         except LdbError, (num, _):
428             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
429
430
431     def _make_class_ldif(self, class_dn, class_name):
432         ldif = """
433 dn: """ + class_dn + """
434 objectClass: top
435 objectClass: classSchema
436 adminDescription: """ + class_name + """
437 adminDisplayName: """ + class_name + """
438 cn: """ + class_name + """
439 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
440 instanceType: 4
441 objectClassCategory: 1
442 subClassOf: organizationalPerson
443 rDNAttID: cn
444 systemMustContain: cn
445 systemOnly: FALSE
446 """
447         return ldif
448
449     def test_msDS_IntId_on_class(self):
450         """Testing msDs-IntId creation for Class
451            Reference: MS-ADTS - 3.1.1.2.4.8 Class classSchema"""
452
453         # 1. Create Class without systemFlags
454         # msDS-IntId should be created if forest functional
455         # level is >= DS_DOMAIN_FUNCTION_2003
456         # and missing otherwise
457         (class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-1-")
458         ldif = self._make_class_ldif(class_dn, class_name)
459
460         # try to add msDS-IntId during Class creation
461         ldif_add = ldif + "msDS-IntId: -1993108831\n"
462         self.ldb.add_ldif(ldif_add)
463         self._ldap_schemaUpdateNow()
464
465         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["msDS-IntId"])
466         self.assertEquals(len(res), 1)
467         self.assertEquals(res[0]["msDS-IntId"][0], "-1993108831")
468
469         # add a new Class and update schema
470         (class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-2-")
471         ldif = self._make_class_ldif(class_dn, class_name)
472
473         self.ldb.add_ldif(ldif)
474         self._ldap_schemaUpdateNow()
475
476         # Search for created Class
477         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["msDS-IntId"])
478         self.assertEquals(len(res), 1)
479         self.assertFalse("msDS-IntId" in res[0])
480
481         msg = Message()
482         msg.dn = Dn(self.ldb, class_dn)
483         msg["msDS-IntId"] = MessageElement("-1993108831", FLAG_MOD_REPLACE, "msDS-IntId")
484         try:
485             self.ldb.modify(msg)
486             self.fail("Modifying msDS-IntId should return error")
487         except LdbError, (num, _):
488             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
489
490         # 2. Create Class with systemFlags = FLAG_SCHEMA_BASE_OBJECT
491         # msDS-IntId should be created if forest functional
492         # level is >= DS_DOMAIN_FUNCTION_2003
493         # and missing otherwise
494         (class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-3-")
495         ldif = self._make_class_ldif(class_dn, class_name)
496         ldif += "systemFlags: 16\n"
497
498         # try to add msDS-IntId during Class creation
499         ldif_add = ldif + "msDS-IntId: -1993108831\n"
500         self.ldb.add_ldif(ldif_add)
501
502         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["msDS-IntId"])
503         self.assertEquals(len(res), 1)
504         self.assertEquals(res[0]["msDS-IntId"][0], "-1993108831")
505
506         # add the new Class and update schema
507         (class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-4-")
508         ldif = self._make_class_ldif(class_dn, class_name)
509         ldif += "systemFlags: 16\n"
510
511         self.ldb.add_ldif(ldif)
512         self._ldap_schemaUpdateNow()
513
514         # Search for created Class
515         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["msDS-IntId"])
516         self.assertEquals(len(res), 1)
517         self.assertFalse("msDS-IntId" in res[0])
518
519         msg = Message()
520         msg.dn = Dn(self.ldb, class_dn)
521         msg["msDS-IntId"] = MessageElement("-1993108831", FLAG_MOD_REPLACE, "msDS-IntId")
522         try:
523             self.ldb.modify(msg)
524             self.fail("Modifying msDS-IntId should return error")
525         except LdbError, (num, _):
526             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
527         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["msDS-IntId"])
528         self.assertEquals(len(res), 1)
529         self.assertFalse("msDS-IntId" in res[0])
530
531
532     def test_verify_msDS_IntId(self):
533         """Verify msDS-IntId exists only on attributes without FLAG_SCHEMA_BASE_OBJECT flag set"""
534         count = 0
535         res = self.ldb.search(self.schema_dn, scope=SCOPE_ONELEVEL,
536                               expression="objectClass=attributeSchema",
537                               attrs=["systemFlags", "msDS-IntId", "attributeID", "cn"])
538         self.assertTrue(len(res) > 1)
539         for ldb_msg in res:
540             if self.forest_level >= DS_DOMAIN_FUNCTION_2003:
541                 if self._is_schema_base_object(ldb_msg):
542                     self.assertTrue("msDS-IntId" not in ldb_msg)
543                 else:
544                     # don't assert here as there are plenty of
545                     # attributes under w2k8 that are not part of
546                     # Base Schema (SYSTEM_FLAG_SCHEMA_BASE_OBJECT flag not set)
547                     # has not msDS-IntId attribute set
548                     #self.assertTrue("msDS-IntId" in ldb_msg, "msDS-IntId expected on: %s" % ldb_msg.dn)
549                     if "msDS-IntId" not in ldb_msg:
550                         count = count + 1
551                         print "%3d warning: msDS-IntId expected on: %-30s %s" % (count, ldb_msg["attributeID"], ldb_msg["cn"])
552             else:
553                 self.assertTrue("msDS-IntId" not in ldb_msg)
554
555
556 class SchemaTests_msDS_isRODC(samba.tests.TestCase):
557
558     def setUp(self):
559         super(SchemaTests_msDS_isRODC, self).setUp()
560         self.ldb =  SamDB(host, credentials=creds,
561             session_info=system_session(lp), lp=lp, options=ldb_options)
562         res = self.ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["defaultNamingContext"])
563         self.assertEquals(len(res), 1)
564         self.base_dn = res[0]["defaultNamingContext"][0]
565
566     def test_objectClass_ntdsdsa(self):
567         res = self.ldb.search(self.base_dn, expression="objectClass=nTDSDSA",
568                               attrs=["msDS-isRODC"], controls=["search_options:1:2"])
569         for ldb_msg in res:
570             self.assertTrue("msDS-isRODC" in ldb_msg)
571
572     def test_objectClass_server(self):
573         res = self.ldb.search(self.base_dn, expression="objectClass=server",
574                               attrs=["msDS-isRODC"], controls=["search_options:1:2"])
575         for ldb_msg in res:
576             ntds_search_dn = "CN=NTDS Settings,%s" % ldb_msg['dn']
577             try:
578                 res_check = self.ldb.search(ntds_search_dn, attrs=["objectCategory"])
579             except LdbError, (num, _):
580                 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
581                 print("Server entry %s doesn't have a NTDS settings object" % res[0]['dn'])
582             else:
583                 self.assertTrue("objectCategory" in res_check[0])
584                 self.assertTrue("msDS-isRODC" in ldb_msg)
585
586     def test_objectClass_computer(self):
587         res = self.ldb.search(self.base_dn, expression="objectClass=computer",
588                               attrs=["serverReferenceBL","msDS-isRODC"], controls=["search_options:1:2"])
589         for ldb_msg in res:
590             if "serverReferenceBL" not in ldb_msg:
591                 print("Computer entry %s doesn't have a serverReferenceBL attribute" % ldb_msg['dn'])
592             else:
593                 self.assertTrue("msDS-isRODC" in ldb_msg)
594
595 if not "://" in host:
596     if os.path.isfile(host):
597         host = "tdb://%s" % host
598     else:
599         host = "ldap://%s" % host
600
601 ldb_options = []
602 if host.startswith("ldap://"):
603     # user 'paged_search' module when connecting remotely
604     ldb_options = ["modules:paged_searches"]
605
606 TestProgram(module=__name__, opts=subunitopts)